1311429 k、發明說明： 【發明所屬之技術領域】 本發明涉及-種電子文檔自動簽名系統及方法。 【先前技術】 通常情况下’電子文檔都是列印紙本，進行 字’電子商務過程執行率低，採用紙本作業增加本。 黎於各國制定了相應的電子簽名法，電子簽名 _本文槽簽名具有同樣的法律效力，進行電子簽名使電= 似有私密性、完整性和不可否認性，可以被 生效的證據應用。 π-催不j 電子簽名主要應關㈣算法和公料碼演算法對 電子文檔進行加密、解密變換實現的，摘要演算 歷、SH)，也叫單向散列演算法，其作用是^ 何不定長的文槽變換爲-個定長的字串或位元串， m位元 '⑽位元' 256位元或512位元等，目的； ί縮短電子簽名文檔的長度，提高簽名的敦率。 錄密碼演算法（如RSA、ECC等），也叫非對稱密 碼演异法，加密和解密使用不同的密鑰，通信雙方各 對密錄（公錄和私餘），各方將私錄嚴格保 開給對方。在電子簽名時發信人用自己 夕π a ,m , 〜私鑰簽名，收作 人用發信人的公鑰驗證。公鑰的可信性是 ”。 ί 〇任關係，， 基礎，-般需要指定-個共同信任的第三方認證授權你 (CA’ Certification Authority)對公鑰進行簽名和發 這種經過第三方認證授權單位簽名並發布的公輪及相關次 7 1311429 訊的統稱就是通常所說的數位證書。 電子簽名的特點是：它代表了文檔的特徵。文檔如發 生改變’電子簽名的值也將隨之而發生改變，不同的文檔 得到的是不同的數位簽名。在傳輸過程中，如有第三人對 文標進行篡改，但他並不知道發送方的私鑰，因此，解密 得到的電子簽名與經過計算後的電子簽名必然不同，這就 提供了一個安全的破認發送方身份的辦法。 I 電子簽名的流程爲：報文的發送方從報文文本中生成 一個報文摘要（或散列值），發送方用自己的私鑰對這個 散列值進行加密來形成發送方的電子簽名；然後，這個電 子簽名將作爲報文的附件和報文一起發送給報文的接收 方’報文的接收方首先從接收到的原始報文中計算出報文 摘要（或散列值），接著再用發送方的公鑰來對報文附加 的電子簽名進行解密，如果兩個摘要相同，那麼接收方就 能確認該電子簽名是發送方的。 隊在2005年1〇月12曰公開、申請號爲〇3822〇34 2的 中國大陸專利申請案’揭露了一種産生和/或確認電子簽名 的方法’透過這種方法產生一個不對稱的密碼對，此密碼 對包括一個專用簽名密鑰和一個公開的確認密鑰。此外， 借助專用簽名密鑰和透過使用爲至少一個電子文檔的一個 預先可確定的簽名函數計算至少一個電子簽名，接著把計 算出的電子簽名和電子文檔一起傳輸到收件人，最後收件 人確5忍該電子簽名。但該發明是在産生電子簽名後由對方 驗證簽名人的身份，沒有在進行電子簽名前驗證簽名人的 8 1311429 身份。 【發明内容】 雲於以上内容，有必要提供一種電子文檔自動簽名系 統，其可在進行電子簽名前驗證衫人的身份，有效防止 了電子簽名被僞造。 寥於以上内容，還有必要提供一種電子文槽自動簽名 方法，其可進行電子簽名前驗證簽名人的身份，有效防止 了電子簽名被僞造。 -種電子文檔自動簽名系統’包括應用電腦、證書祠 服器、用戶端電腦及資料庫’所述的應用電腦 生成模組’祕生錢行電子簽名的電子⑽，發送簽名田 資訊到用戶端電腦，通知用戶進行電子簽名操作；驗證模 組，用於當用戶確認該電子簽名操作後從資料庫中獲取該 用戶的數位證書，根據該數位證書對該用 證；文職要生组1於在好身份驗4=2 成所述電子域關要；加龍組，祕_所述數位證 書中的私賴該電子文槽的摘要進行加密，得到所述 文檔的電子簽名。 於雷&種電子讀自動簽名方法，包括如下步驟：生成用 知用/名的好讀，發送簽名資制用戶端電腦，通 資料座進行電子簽名操作；用戶相該電子衫操作；從 中獲取該用戶的數位證書；根據該數位證書對該用 文梓身份進行驗證；用戶身份驗證通過後，生成所述電子 虽的摘要；根據所述數位證書中的私鑰對該電子文檔的 1311429 * m· 摘要進行加密，得到所述電子文檔的電子簽名。 相較於習知技術，所述的電子文檐自動簽名系統及方 法，能够對電子文權進行自動簽名，並在進行電子簽名前 驗證簽名人的身份，有效防止了電子簽名被僞造。 【實施方式】 參閱圖1所示，是本發明電子文檔自動簽名系統較佳 實施例的硬體架構圖。該系統主要包括應用電腦10、證書 馨伺服器20、網路30、多個用戶端電腦40及資料庫5〇。所 述應用電腦透過網路3〇與證書伺服器2〇及用戶端電腦 40相連，所述證書伺服器20用於生成密鍮對（包括公输 - 和私鑰），對用戶的數位證書申請進行認證，如果用戶的該 申請通過，則授權給該用戶一份數位證書。所述數位證書 包括：用戶的資訊、公鑰、私鑰、有效期等，其中，公鑰 是公開給對方的，用於對方驗證自己的身份，在該發明當 中，公鑰還用來在對電子文檔進行電子簽名前驗證簽名人 • 的身份；私鑰是嚴格保密的，用於用戶對電子文檔進行電 子簽名。在電子簽名時發信人用自己的私餘簽名，收信人 用發信人的公鎗驗證。 所述應用電腦10和用戶端電腦40裝有簽名系統，其 中，用戶端電腦40中的簽名系統提供用戶端的簽名入口操 作，應用電腦10中的簽名系統提供後臺操作。所述應用電 腦10用於生成進行電子簽名的電子文檔、驗證簽名人的身 份、生成電子文檔的摘要及對電子文檔進行加密生成電子 簽名等。 1311429 、所述證書飼服器2〇連接有資料庫5〇，該資料庫 存儲有數位證書。 如下所述，是透過前述電子文槽自動簽 電子簽名的步驟。 首先，應用電腦10生成用於電子簽名的電子文斤， 透過網路30發送簽名資訊到用戶端電腦⑼，通田 行電子Μ操作。用戶_該簽名通知後，絲到簽 統確認該簽名資訊。然、後，應用電腦1〇透過網路從二 書飼服器20的資料庫5G中獲取該用戶的數位證書，根ς 該數位證書對該用戶的身份進行驗證。如果該用戶的身份 驗證通過，則進行電子文檔的電子簽名操作。 參閱圖2所示，是圖i所示應用電腦1〇的功能模組 …所述應用電腦10包括文檔生成模組101，驗證模組 1〇2，文檔摘要生成模組1〇3及加密模組。 _ /、中’讀生成馳1Q1用於生成進行電子簽名的電 檔透過網路30發送簽名資訊到用戶端電腦40，通 知用戶進行電子簽名操作。 驗倾組1G2用於當用戶確認該電子簽名操作後透過 3〇從證書飼服器20的資料庫50中獲取該用戶的數位 ^ ’ ^據該數錄書對登制簽名线的該用戶的身份 瑜行驗姐。如果該數位證書中含有該用戶的用戶資訊和公 並且^有效期在有效範圍内，則該用戶的身份驗證通過。 # π文檔摘要生成模組103用於在用戶身份驗證通過後， 根據摘要演算法生朗述電子文標的摘要。 11 1311429 *加密模組104用於根據所述數位證書中的私鑰對該電 子文檔的摘要進行加密，得到所述電子文檔的電子簽名。 參閱圖3所示，是本發明電子文檔自動簽名方法較佳 實施例的流程圖。首先，文檔生成模組1〇1生成用於電子 簽名的電子文檔，透過網路30發送簽名資訊到用戶端電腦 40 ’通知用戶進行電子簽名操作（步驟s4〇〇)。用戶收到 該電子簽名通知後，登錄到簽名系統確認該電子簽名操作1311429 k, invention description: [Technical field of invention] The present invention relates to an electronic document automatic signature system and method. [Prior Art] Under normal circumstances, 'electronic documents are printed on paper, and the word 'e-commerce process' has a low implementation rate, which is increased by paperwork. Li has developed corresponding electronic signature laws in various countries, and electronic signatures have the same legal effect. Electronic signatures make electricity = seemingly private, complete and non-repudiation, and can be applied to evidence that is effective. Π- reminder j electronic signature mainly should be closed (4) algorithm and public material code algorithm to encrypt and decrypt the electronic document, abstract calculus, SH), also called one-way hash algorithm, its role is ^ The variable length of the trough is transformed into a fixed length string or a bit string, m bits '(10) bits '256 bits or 512 bits, etc., purpose; ί shortens the length of the electronic signature document and improves the signature of the rate. Recording cryptographic algorithms (such as RSA, ECC, etc.), also called asymmetric cryptography, use different keys for encryption and decryption, and the two sides of the communication are privately recorded (public and private). Keep open to the other party. At the time of electronic signature, the sender signs with his own ππ a , m , ~ private key, and the recipient uses the sender's public key to verify. The credibility of the public key is ". ί 〇 , , , , 基础 基础 - - - - - - 需要 需要 需要 需要 需要 需要 需要 需要 CA CA CA CA CA CA CA CA CA CA CA CA CA CA CA CA CA CA CA CA The collective name of the public sign and related 7 1311429 issued by the authorized unit is the so-called digital certificate. The characteristic of the electronic signature is that it represents the characteristics of the document. If the document changes, the value of the electronic signature will also follow. When a change occurs, different documents get different digital signatures. In the transmission process, if a third person tampers with the text, but he does not know the sender's private key, the decrypted electronic signature and The calculated electronic signature must be different, which provides a safe way to break the identity of the sender. I The process of electronic signature is: the sender of the message generates a message digest (or hash) from the message text. Value), the sender encrypts the hash value with its own private key to form the sender's electronic signature; then, the electronic signature will be attached to the message The receiver and the message are sent to the receiver of the message. The receiver of the message first calculates the message digest (or hash value) from the received original message, and then uses the sender's public key to match the message. The additional electronic signature is decrypted, and if the two digests are the same, the recipient can confirm that the electronic signature is the sender. The team disclosed the Chinese patent in the first quarter of 2005, the application number is 〇3822〇34 2 The application 'discloses a method of generating and/or confirming an electronic signature' generates an asymmetric pair of passwords by this method, the pair of passwords including a private signature key and a public confirmation key. In addition, with a dedicated signature The key and the at least one electronic signature are calculated by using a pre-determinable signature function for the at least one electronic document, and then the calculated electronic signature is transmitted to the recipient together with the electronic document, and finally the recipient does not endure the electronic Signature. But the invention is to verify the identity of the signer by the other party after the electronic signature is generated, and the signer is not verified before the electronic signature 8 1311429 [Invention] In the above content, it is necessary to provide an electronic document automatic signature system, which can verify the identity of the shirt person before electronic signature, and effectively prevent the electronic signature from being forged. The invention provides an electronic signature automatic signature method, which can verify the identity of the signer before electronic signature, and effectively prevent the electronic signature from being forged. - An electronic document automatic signature system includes an application computer, a certificate server, a client computer and The application computer generated module described in the database 'secret money line electronic signature electronic (10), sends the signature field information to the client computer, notifies the user to perform an electronic signature operation; the verification module is used when the user confirms the electronic signature After the operation, the user's digital certificate is obtained from the database, and the certificate is used according to the digital certificate; the civilian student group 1 is in the good identity 4=2 into the electronic domain; the Jialong group, the secret _ The digest in the digital certificate is encrypted by the digest of the electronic spoof to obtain an electronic signature of the document. Yu Lei & electronic reading automatic signature method, including the following steps: generating good reading with knowledge/name, sending the signature client computer, and electronically signing through the data holder; the user is operating the electronic shirt; a digit certificate of the user; verifying the identity of the document according to the digital certificate; after the user identity verification is passed, generating a summary of the electronic; according to the private key in the digital certificate, the electronic document is 1311429 * m · The abstract is encrypted to obtain an electronic signature of the electronic document. Compared with the prior art, the electronic signature automatic signature system and method can automatically sign electronic document rights and verify the identity of the signer before electronic signature, thereby effectively preventing the electronic signature from being forged. [Embodiment] Referring to Figure 1, there is shown a hardware architecture diagram of a preferred embodiment of the electronic document automatic signature system of the present invention. The system mainly includes an application computer 10, a certificate server 20, a network 30, a plurality of client computers 40, and a database. The application computer is connected to the certificate server 2〇 and the client computer 40 via the network 3. The certificate server 20 is configured to generate a password pair (including a public transmission and a private key), and perform a digital certificate application for the user. Authentication, if the user's application passes, authorize the user a digital certificate. The digital certificate includes: a user's information, a public key, a private key, an expiration date, etc., wherein the public key is disclosed to the other party, and is used by the other party to verify their identity. In the invention, the public key is also used in the electronic The identity of the signer is verified before the document is electronically signed; the private key is strictly confidential and is used by the user to electronically sign the electronic document. When the electronic signature is made, the sender signs with his own private signature, and the recipient uses the sender's rifle to verify. The application computer 10 and the client computer 40 are provided with a signature system, wherein the signature system in the client computer 40 provides a signature entry operation of the client, and the signature system in the application computer 10 provides background operations. The application computer 10 is configured to generate an electronic document for electronic signature, verify the identity of the signer, generate a digest of the electronic document, and encrypt the electronic document to generate an electronic signature. 1311429, the certificate feeding device 2 is connected with a database 5, which stores a digital certificate. As described below, the electronic signature is automatically signed through the aforementioned electronic message slot. First, the application computer 10 generates an electronic signature for the electronic signature, and transmits the signature information to the client computer (9) via the network 30. After the user_ the signature notification, the signature to the signature is confirmed. Then, the application computer 1 obtains the digital certificate of the user from the database 5G of the second book feeder 20 through the network, and verifies the identity of the user based on the digital certificate. If the user's identity is verified, an electronic signature operation of the electronic document is performed. Referring to FIG. 2, it is a functional module of the application computer shown in FIG. 1. The application computer 10 includes a document generation module 101, a verification module 1〇2, a document summary generation module 1〇3, and an encryption module. group. _ /, medium read generation 1Q1 is used to generate an electronic signature to send signature information to the client computer 40 via the network 30 to notify the user of the electronic signature operation. The inspection group 1G2 is used to acquire the digit of the user from the database 50 of the certificate feeder 20 after the user confirms the electronic signature operation, and according to the number of the book, the user who has signed the signature line Identity yoga test sister. If the digital certificate contains the user information and the public and the validity period of the user is within the valid range, the user's identity verification is passed. The # π document summary generation module 103 is configured to summarize the summary of the electronic document based on the digest algorithm after the user identity verification is passed. 11 1311429 * The encryption module 104 is configured to encrypt the abstract of the electronic document according to the private key in the digital certificate to obtain an electronic signature of the electronic document. Referring to Figure 3, there is shown a flow chart of a preferred embodiment of the electronic document automatic signature method of the present invention. First, the document generation module 101 generates an electronic document for electronic signature, and transmits the signature information to the client computer 40 via the network 30 to notify the user of the electronic signature operation (step s4). After receiving the electronic signature notification, the user logs in to the signature system to confirm the electronic signature operation.
(^驟S401)。然後，驗證模組1〇2透過網路3〇從證書伺 器20的貝料庫5〇中獲取該用戶的數位證書（步驟 S^)’根據該數位證書中用戶的#訊、公鑰、有效期等 貝訊對該用戶的身份進行驗證（步驟S4〇3)，判斷該用戶 的身份是否合法（步驟S4〇4)。(^S401). Then, the verification module 1〇2 obtains the digital certificate of the user from the database 5 of the certificate server 20 via the network 3 (step S^)' according to the user's ##, public key, The validity period, etc., verifies the identity of the user (step S4〇3), and determines whether the identity of the user is legal (step S4〇4).
如果該數位證書中含有該用戶的用戶資訊和公餘，並 摘要政期在有效範圍内，則該用戶的身份驗證通過，文檔 〜個〜成模組根據摘要演算法將所述電子文檔變換爲 驟^定長的字f或位7^串’生成所述電子文槽的摘要（步 述 ）加岔模組104根據所述數位證書中的私输對所 名γ =文標的摘要進行加S，得到所述電子文制電子簽 }社乂驟S4()6)。如果該用戶的身份驗證沒有通過，則阻 ^用戶的數位^名操作，流程結束。 例揭，明電子文檔自動簽名系統及方法，雖以較佳實施 藝之路如_L U並翻㈣定本發明。任㈣悉此項技 與潤2士 ’在不脫離本發明之精神及範圍内，當可做更動 因此本發明之保護範圍當視後附之申請專利範圍 12 1311429 y r 所界定者為準。 【圖式簡單說明】 圖1是本發明電子文檔自動簽名系統較佳實施例的硬 體架構圖。 圖2是圖1所示應用電腦的功能模組圖。 圖3是本發明電子文檔自動簽名方法較佳實施例的流 程圖。 【主要元件符號說明】 鲁應用電腦 10 證書伺服器 20 網路 30 用戶端電腦 40 資料庫 50 文檔生成模組 101 驗證模組 102 ^ 文檔摘要生成模組 103 0 ' 加密模組 104 13If the digital certificate contains the user information and the publicity of the user, and the summary policy is within the valid range, the user's identity verification is passed, and the document~~~ module converts the electronic document into a digest algorithm according to a digest algorithm. Generating a long word f or a bit 7 string 'generating a summary (step) of the electronic suffixing module 104 to add a sigma to the gamma of the name γ = the text based on the private input in the digital certificate Obtaining the electronic electronic document signing agency step S4 () 6). If the user's authentication fails, the user's digital operation is blocked and the process ends. For example, the automatic electronic document automatic signature system and method, although the preferred implementation of the art road such as _L U and turn (four) to determine the invention. The scope of protection of the present invention is defined by the scope of the appended patent application 12 1311429 y r, which is subject to change without departing from the spirit and scope of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a hardware structural diagram of a preferred embodiment of an electronic document automatic signature system of the present invention. 2 is a functional block diagram of the application computer shown in FIG. 1. Fig. 3 is a flow chart showing a preferred embodiment of the electronic document automatic signature method of the present invention. [Main component symbol description] Lu application computer 10 certificate server 20 network 30 client computer 40 database 50 document generation module 101 verification module 102 ^ document summary generation module 103 0 ' encryption module 104 13